General

  • Target

    1100-57-0x0000000000170000-0x00000000001DF000-memory.dmp

  • Size

    444KB

  • MD5

    7de591e789330b7e552afc08dfa10db6

  • SHA1

    c633f35133aaaabf33e3715f6c96c2009775f328

  • SHA256

    c0c459564513d0d1885e1d9a9ec3b452b805c95b81a91b2fd1b51176c0f49f58

  • SHA512

    fbcb92d37c865a9726e7d0e208c567dc38566ab2260f8d89e31c8cf6c8305b8b9f23af9d6de982f38e09274ef142855023af8295400d437db9082d1ab575f3cf

  • SSDEEP

    768:A2M1D05UC2Tm8lVvby2AZLKuFjoaHddrJ6271EPs1hSe7cBVksMPyx2:G1K2Tm8lVA5pVddIZP6se4Hs

Score
10/10

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.15

109.230.199.114

Attributes
  • base_path

    /drew/

  • build

    250235

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

Files

  • 1100-57-0x0000000000170000-0x00000000001DF000-memory.dmp
    .dll windows x86


    Headers

    Sections